fix(inbound-api): resolve InboundAPI-002,004,006,008 — disconnect vs timeout, body size limit, active-node gate; surface InboundAPI-007

tests/ScadaLink.InboundAPI.Tests/EndpointGatingTests.cs

@@ -0,0 +1,147 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.Features;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+
+namespace ScadaLink.InboundAPI.Tests;
+
+/// <summary>
+/// InboundAPI-006 / InboundAPI-008: the POST /api/{methodName} endpoint must be
+/// gated to the active central node and must cap the request body size. These
+/// behaviours are enforced by <see cref="InboundApiEndpointFilter"/>.
+/// </summary>
+public class EndpointGatingTests
+{
+    private static InboundApiEndpointFilter CreateFilter(InboundApiOptions? options = null) =>
+        new(NullLogger<InboundApiEndpointFilter>.Instance,
+            Options.Create(options ?? new InboundApiOptions()));
+
+    private static (DefaultHttpContext ctx, DefaultEndpointFilterInvocationContext invocation)
+        BuildInvocation(bool? activeNode, long? contentLength)
+    {
+        var services = new ServiceCollection();
+        if (activeNode.HasValue)
+            services.AddSingleton<IActiveNodeGate>(new StubActiveNodeGate(activeNode.Value));
+
+        var ctx = new DefaultHttpContext
+        {
+            RequestServices = services.BuildServiceProvider()
+        };
+        ctx.Request.Method = "POST";
+        if (contentLength.HasValue)
+            ctx.Request.ContentLength = contentLength.Value;
+
+        return (ctx, new DefaultEndpointFilterInvocationContext(ctx));
+    }
+
+    private static EndpointFilterDelegate NextSentinel(out Func<bool> wasCalled)
+    {
+        var called = false;
+        wasCalled = () => called;
+        return _ =>
+        {
+            called = true;
+            return ValueTask.FromResult<object?>(Results.Ok("handler-ran"));
+        };
+    }
+
+    // --- InboundAPI-008: standby node must not serve inbound API calls ---
+
+    [Fact]
+    public async Task StandbyNode_ShortCircuitsWith503_AndDoesNotRunHandler()
+    {
+        var (_, invocation) = BuildInvocation(activeNode: false, contentLength: 2);
+        var next = NextSentinel(out var handlerRan);
+
+        var result = await CreateFilter().InvokeAsync(invocation, next);
+
+        Assert.False(handlerRan());
+        var status = Assert.IsAssignableFrom<IStatusCodeHttpResult>(result);
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, status.StatusCode);
+    }
+
+    [Fact]
+    public async Task ActiveNode_PassesGate_RunsHandler()
+    {
+        var (_, invocation) = BuildInvocation(activeNode: true, contentLength: 2);
+        var next = NextSentinel(out var handlerRan);
+
+        await CreateFilter().InvokeAsync(invocation, next);
+
+        Assert.True(handlerRan());
+    }
+
+    [Fact]
+    public async Task NoGateRegistered_PassesGate_RunsHandler()
+    {
+        // When no IActiveNodeGate is registered (non-clustered host), gating is
+        // opt-in and defaults to "allow" so the endpoint is still served.
+        var (_, invocation) = BuildInvocation(activeNode: null, contentLength: 2);
+        var next = NextSentinel(out var handlerRan);
+
+        await CreateFilter().InvokeAsync(invocation, next);
+
+        Assert.True(handlerRan());
+    }
+
+    // --- InboundAPI-006: request body size must be capped ---
+
+    [Fact]
+    public async Task OversizedBody_ShortCircuitsWith413_AndDoesNotRunHandler()
+    {
+        var options = new InboundApiOptions();
+        var (_, invocation) = BuildInvocation(
+            activeNode: true, contentLength: options.MaxRequestBodyBytes + 1);
+        var next = NextSentinel(out var handlerRan);
+
+        var result = await CreateFilter(options).InvokeAsync(invocation, next);
+
+        Assert.False(handlerRan());
+        var status = Assert.IsAssignableFrom<IStatusCodeHttpResult>(result);
+        Assert.Equal(StatusCodes.Status413PayloadTooLarge, status.StatusCode);
+    }
+
+    [Fact]
+    public async Task BodyAtLimit_RunsHandler()
+    {
+        var options = new InboundApiOptions();
+        var (_, invocation) = BuildInvocation(
+            activeNode: true, contentLength: options.MaxRequestBodyBytes);
+        var next = NextSentinel(out var handlerRan);
+
+        await CreateFilter(options).InvokeAsync(invocation, next);
+
+        Assert.True(handlerRan());
+    }
+
+    [Fact]
+    public async Task FilterCapsMaxRequestBodySizeFeature()
+    {
+        // For chunked/unknown-length requests there is no Content-Length, so the
+        // filter must also cap the per-request body size feature so Kestrel rejects
+        // an oversized stream while it is being read.
+        var options = new InboundApiOptions();
+        var (ctx, invocation) = BuildInvocation(activeNode: true, contentLength: null);
+        ctx.Features.Set<IHttpMaxRequestBodySizeFeature>(new StubMaxBodySizeFeature());
+        var next = NextSentinel(out _);
+
+        await CreateFilter(options).InvokeAsync(invocation, next);
+
+        var feature = ctx.Features.Get<IHttpMaxRequestBodySizeFeature>();
+        Assert.Equal(options.MaxRequestBodyBytes, feature!.MaxRequestBodySize);
+    }
+
+    private sealed class StubActiveNodeGate : IActiveNodeGate
+    {
+        private readonly bool _isActive;
+        public StubActiveNodeGate(bool isActive) => _isActive = isActive;
+        public bool IsActiveNode => _isActive;
+    }
+
+    private sealed class StubMaxBodySizeFeature : IHttpMaxRequestBodySizeFeature
+    {
+        public bool IsReadOnly => false;
+        public long? MaxRequestBodySize { get; set; }
+    }
+}